Lei 22/11 art. 29.º — decisões individuais automatizadas: the only prohibition on the tracker that the data-protection authority can licence
Binds Responsáveis pelo tratamento — controllers — with subcontratados (processors) bound through the art. 23 processor regime. Art. 3(1) makes the scope explicitly tri-sectoral: the Law catches processing carried out by any person or entity of the public, private or cooperative sector. Art. 3(2) sets the territorial reach at four limbs: processing by a controller headquartered in the Republic of Angola; processing in the context of the activities of a controller established in Angola even where that controller is not headquartered in Angolan territory; processing outside Angola where Angolan law applies by virtue of public or private international law; and processing by a controller not established in Angola that resorts, for the processing, to means situated in Angolan territory. Art. 3(3) makes that last limb wide — a controller is deemed to resort to means in Angolan territory where the processing operations are carried out with, or the data are hosted on, means situated in Angola, the mere use of such means for the collection, recording or transit of personal data in the territory being enough. Art. 3(4) then requires any controller caught by the means limb to designate, by communication to the Agência de Protecção de Dados, a representative established in Angola who substitutes for it in all its rights and obligations, without prejudice to the controller's own liability — so a foreign scoring or profiling operator hosting on Angolan infrastructure is both bound by art. 29 and required to stand up a local representative. Art. 4 excludes processing by a natural person in the exercise of exclusively personal or domestic activities, and, without prejudice to special legislation, processing under the legal rules on state secrecy and security and on judicial secrecy, and processing of the personal data of members of the Angolan Armed Forces by military units, establishments and organs. Impact tier: all entities — art. 29 applies to every controller in every sector, with no employee-count, turnover or high-risk-system threshold, and its named evaluation grounds (professional capacity, credit, trustworthiness, conduct) put hiring and credit-scoring deployers squarely in scope.. Article 29.º of Lei n.º 22/11, de 17 de Junho — Lei da Protecção de Dados Pessoais is Angola's automated-decision provision, and it is Portuguese Lei 67/98 lineage rather than the Directive 95/46/EC transposition template that the Francophone African rows carry or the GDPR template that Cameroon carries. Under art. 29(1), qualquer pessoa tem o direito de não ficar sujeita a uma decisão que produza efeitos na sua esfera jurídica ou que a afecte de modo significativo, tomada exclusivamente com base num tratamento automatizado de dados destinado a avaliar determinados aspectos da sua personalidade, designadamente, a sua capacidade profissional, o seu crédito, a confiança de que é merecedora ou o seu comportamento — any person has the right not to be subject to a decision producing effects in their legal sphere or significantly affecting them, taken exclusively on the basis of automated data processing intended to evaluate certain aspects of their personality, namely their professional capacity, their credit, their trustworthiness or their conduct. The trigger is the classical one: solely automated, evaluative, and gated by a legal-effects-or-significant-effect threshold, so it is narrower than Equatorial Guinea's art. 13(b) and narrower than Cameroon's art. 44, neither of which requires a threshold. What makes Angola structurally different is the second route out. Art. 29(2) carries the familiar contract exception — a person may be subject to such a decision where it occurs in the conclusion or performance of a contract and either their request to conclude or perform was satisfied, or adequate measures exist guaranteeing the defence of their legitimate interests, designadamente o seu direito de representação e expressão, namely their right of representation and expression. Art. 29(3) then adds a route no other tracked jurisdiction has: pode ainda ser permitida a tomada de uma decisão, nos termos do n.º 1 deste artigo, quando a Agência de Protecção de Dados o autorize, definindo medidas de garantia da defesa dos interesses legítimos do titular dos dados — the decision may further be permitted where the Agência de Protecção de Dados authorises it, itself defining the measures that guarantee the defence of the data subject's legitimate interests. Every other prohibition on the tracker admits exceptions fixed in the statute (consent, contract, or a law laying down safeguards); Angola is the only one where the supervisory authority can licence an otherwise-forbidden automated decision case by case and write the safeguards for it. The safeguard package is also thinner than the GDPR's. Art. 29(2) gives a right of representation and expression but no right to obtain human intervention in the decision and no right to contest it after the fact, and the Law carries no logic-disclosure duty anywhere: the art. 25 information list runs through purposes, recipients, whether the answer is obligatory, the existence and conditions of access, rectification, updating, elimination and opposition, and the consequences of collection without consent, with no item on the existence of automated decision-making and no item on the logic involved; and the art. 26 access right reaches confirmation, purposes, categories, recipients, the specific data and available information on their origin, but not the logic of any automated processing. So a data subject in Angola may never learn that a machine decided, and if the Agência authorises the decision under art. 29(3) the safeguards they get are whatever that authorisation says. Impact tier: all entities.
Force, and the date is exact. Art. 67.º (Entrada em vigor) provides A presente lei entra em vigor à data da sua publicação — the Law enters into force on the date of its publication — and it was published in the Diário da República, I Série, n.º 114, de 17 de Junho de 2011, at pp. 3185-3202. The instrument was approved by the Assembleia Nacional in Luanda on 24 May 2011 and promulgated by President José Eduardo dos Santos on 8 June 2011; art. 64.º revokes all legislation contrary to it, and art. 63.º gave controllers of pre-existing processing two years from entry into force to notify the Agência de Protecção de Dados. Art. 65.º required the Executive to regulate the Law within 120 days of publication. Supersession: none in force. A revision is live but has not been enacted — the Agência de Protecção de Dados ran a public consultation titled Projecto de Revisão da Lei n.º 22/11, de 17 de Junho - Lei de Protecção de Dados Pessoais on the Government's consultapublica.gov.ao portal from 17 March 2025 to 17 April 2025, and that consultation is recorded as Encerrada (closed). No successor law has appeared in the Diário da República, so Lei 22/11 art. 29 is the operative rule today and the draft is tracked as a watch item, not as a dateset entry; it will only be published as an obligation once the successor is gazetted with an entry-into-force clause. No AI-specific statute is in force in Angola and the Law does not define artificial intelligence — Gabon's Loi 025/2023 remains the only data-protection statute in the African block that does. Text read in full in the official scanned copy of the Diário da República issue published by the Agência de Protecção de Dados itself, the supervisory authority created by the Law, which satisfies Primary Source First on the same basis as the Nigeria, Burkina Faso, Gabon, Chad and Equatorial Guinea copies. The copy is an 18-page image-only scan (RC4-40 encrypted, DCTDecode page streams) with no text layer and was read as page images. Coverage of the read: art. 3 scope and art. 4 exclusions in full; art. 5 definitions; the whole of Secção IV Direitos dos Titulares dos Dados, arts. 25 information, 26 access, 27 opposition, 28 rectification-updating-elimination and 29 automated individual decisions, verbatim; arts. 17-19 and 22-24 on video surveillance, direct marketing, communication of data, processors and interconnection; arts. 44-46 on the Agência; and the whole of Capítulo IV, arts. 47-62 — administrative and judicial protection, civil liability, contraventions and fines, and the criminal section — plus Capítulo V arts. 63-67. Confidence high: the article was read verbatim in the gazette text, the entry-into-force clause is explicit, and the enforcement route was traced through the sanction articles rather than assumed.
Stated maximum penalty — No fine attaches to art. 29 itself — the enforcement route is indirect, and this is the entry's most consequential finding. Art. 51.º(1) enumerates the contraventions exhaustively by article number: alínea a) sets USD 75,000.00 to USD 150,000.00 for breach of the obligations in arts. 14.º, 15.º, 16.º, 17.º, 20.º, 30.º, 31.º and 32.º, for negligent failure to notify the Agência or notification with false information, and for failing to comply with an Agência order to cease access to open transmission networks; alínea b) sets USD 65,000.00 to USD 130,000.00 for breach of the principles in arts. 6.º to 11.º, for processing without the data subject's consent where no dispensation applies, and for breach of arts. 18.º, 19.º and 21.º to 24.º. Art. 29.º appears in neither list. Art. 51.º(2) trebles the respective limits for legal persons, companies and de facto associations — so the ceiling elsewhere in the Law reaches USD 450,000.00 — and art. 51.º(3) makes negligence and attempt punishable; art. 53.º gives the Agência de Protecção de Dados the power to apply the fines, its homologated deliberation constituting an enforceable title if not challenged in the legal period. What a data subject actually has against an unlawful automated decision is three-fold. First, art. 47.º: without prejudice to the right to complain to the Agência, any person may use administrative or judicial means to secure compliance with the data-protection provisions, and decisions of the Agência are themselves subject to contentious administrative appeal. Second, art. 48.º: anyone who has suffered moral or material harm through the undue use of personal data has the right to demand reparation by judicial route, with the judge grading the injury objectively. Third, and the sharpest, art. 58.º (Desobediência qualificada): whoever, having been notified to that effect, fails to interrupt, cease or block the processing of personal data is punished with imprisonment of up to 3 years or a corresponding fine — so once the Agência orders an art. 29 profiling operation stopped, defying the order is a crime. Art. 61.º allows accessory penalties alongside applied fines, including temporary or definitive prohibition of the processing, blocking, erasure or total or partial destruction of the data, publication of the conviction at the convicted party's expense, and public warning or censure of the controller. Separately, art. 55.º(1)(a) makes it a crime punishable with 3 to 18 months' imprisonment or a corresponding fine to omit the request for authorisation to the Agência de Protecção de Dados — a limb that on its face reaches a controller who takes an art. 29(1) decision on the art. 29(3) footing without ever having sought the Agência's authorisation, though the Law does not spell that application out and it has not been tested.